Extracted

• • Target

    3a252ac37d78baad0a81242c0cb2bd68208c12267aa87d3cd3c5d594f1de27a5

  • Size

    418KB

  • MD5

    b8ea5cdd085bea860fb94bef2fecb6d9

  • SHA1

    3788cec204c0f2f6fe674fba85895f99f48a1f23

  • SHA256

    3a252ac37d78baad0a81242c0cb2bd68208c12267aa87d3cd3c5d594f1de27a5

  • SHA512

    45dabd78a10f66209abef6446b96f4782ff7b6a20380282a5be6380f3d7e50020d171478226752659f0808f5d1ce870f617add30d132f981bbcb26347ff6a632

  • SSDEEP

    12288:4r7ox3gdRAAzI+L7sCcDIg54qlcepleY:43ox3ghzHsIg2yvU

  Score

  10^/10

  gozi_ifsb1100bankerpersistencetrojan

  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

    bankertrojangozi_ifsb

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2